@absolutejs/absolute 0.20.0-beta.82 → 0.20.0-beta.84

package/dist/cli/index.js

@@ -203,7 +203,7 @@ if (command === "dev") {
   sendTelemetryEvent("cli:command", {
     command: `mobile:${workspaceCommand ?? "unknown"}`
   });
-  const { runMobile } = await import("./mobile-hkxh2ab5.js");
+  const { runMobile } = await import("./mobile-pdck6a35.js");
   try {
     await runMobile(args);
   } catch (error) {

package/dist/cli/{mobile-hkxh2ab5.js → mobile-pdck6a35.js}

@@ -2,6 +2,9 @@
 import {
   installPackages
 } from "./index-zh6hhrwy.js";
+import {
+  formatBytes
+} from "./index-9r7n9dqp.js";
 import {
   start
 } from "./index-q78x1k9q.js";
@@ -21985,6 +21988,50 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 import { access as access11 } from "fs/promises";
 import { isAbsolute as isAbsolute5, relative as relative10, resolve as resolve11, sep as sep6 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
+var lifecycleMethod = (publisher, name) => {
+  const method = publisher[name];
+  if (typeof method !== "function")
+    throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
+  return method;
+};
+var validOptionalCounters = (values) => values.every((value) => value === undefined) || values.every((value) => Number.isSafeInteger(value) && (value ?? -1) >= 0);
+var validateStorageIdentity = (result, appId) => {
+  if (!object3(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
+    result.channelCount,
+    result.reclaimableBytes,
+    result.releaseBytes,
+    result.releaseCount,
+    result.totalBytes,
+    result.totalObjectCount,
+    result.untrackedBytes
+  ].every((value) => Number.isSafeInteger(value) && value >= 0) || !validOptionalCounters([
+    result.contentBlobBytes,
+    result.contentBlobCount,
+    result.reclaimableContentBytes
+  ]))
+    throw new TypeError("Mobile update registry returned an invalid storage report.");
+  return result;
+};
+var inspectAbsoluteMobileUpdateStorage = async (options) => validateStorageIdentity(await lifecycleMethod(options.publisher, "inspectUpdateStorage")({
+  appId: options.appId,
+  ...options.minAgeMs === undefined ? {} : { minAgeMs: options.minAgeMs },
+  ...options.retainRecent === undefined ? {} : { retainRecent: options.retainRecent },
+  ...options.signal ? { signal: options.signal } : {}
+}), options.appId);
+var pruneAbsoluteMobileUpdates = async (options) => {
+  const result = await lifecycleMethod(options.publisher, "pruneUpdates")({
+    appId: options.appId,
+    ...options.apply === undefined ? {} : { apply: options.apply },
+    ...options.gracePeriodMs === undefined ? {} : { gracePeriodMs: options.gracePeriodMs },
+    ...options.minAgeMs === undefined ? {} : { minAgeMs: options.minAgeMs },
+    ...options.retainRecent === undefined ? {} : { retainRecent: options.retainRecent },
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  validateStorageIdentity(result, options.appId);
+  if (!Array.isArray(result.marked) || !Array.isArray(result.restored) || !Array.isArray(result.swept) || result.sweptContentBlobs !== undefined && !Array.isArray(result.sweptContentBlobs) || typeof result.dryRun !== "boolean" || !Number.isSafeInteger(result.reclaimedBytes) || result.reclaimedBytes < 0)
+    throw new TypeError("Mobile update registry returned an invalid collection report.");
+  return result;
+};
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath3 = (projectRoot, requested, label) => {
@@ -22027,7 +22074,12 @@ var publishAbsoluteMobileUpdate = async (options) => {
     rollout: options.rollout,
     signal: options.signal
   });
-  if (result.appId !== manifest.appId || result.channel !== manifest.channel || result.releaseId !== manifest.releaseId || result.rollout !== options.rollout || result.stage !== "published" || typeof result.reused !== "boolean")
+  if (result.appId !== manifest.appId || result.channel !== manifest.channel || result.releaseId !== manifest.releaseId || result.rollout !== options.rollout || result.stage !== "published" || typeof result.reused !== "boolean" || !validOptionalCounters([
+    result.storedBytes,
+    result.storedFiles,
+    result.reusedBytes,
+    result.reusedFiles
+  ]))
     throw new TypeError("Mobile update registry returned a different publication identity.");
   return result;
 };
@@ -22741,7 +22793,7 @@ var provisionMobileUpdate = async (args) => {
     throw new TypeError("--storage must be local or s3.");
   const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   const packages = [
-    "@absolutejs/deploy@0.25.6",
+    "@absolutejs/deploy@0.25.7",
     "@absolutejs/blob@0.5.2",
     ...requestedStorage === "s3" ? [
       "@aws-sdk/client-s3@3.1095.0",
@@ -22790,6 +22842,8 @@ var publishMobileUpdate = async (args) => {
     rollout: updateRollout(args, 0.05)
   });
   console.log(`${result.reused ? "Reused" : "Published"} mobile update ${result.releaseId} to ${result.channel} at ${Math.round(result.rollout * 100)}%.`);
+  if (result.storedBytes !== undefined && result.reusedBytes !== undefined && result.storedFiles !== undefined && result.reusedFiles !== undefined)
+    console.log(`Stored ${formatBytes(result.storedBytes)} in ${result.storedFiles} new content blobs; reused ${formatBytes(result.reusedBytes)} across ${result.reusedFiles} files.`);
   return result;
 };
 var promoteMobileUpdate = async (args) => {
@@ -22825,6 +22879,99 @@ var rollbackMobileUpdate = async (args) => {
   console.log(result.releaseId ? `Rolled ${result.channel} back to ${result.releaseId}.` : `Rolled ${result.channel} back to the embedded store build.`);
   return result;
 };
+var mobileUpdateDays = (args, flag) => {
+  const value = valueAfter(args, flag);
+  if (value === undefined)
+    return;
+  const parsed = Number(value);
+  const milliseconds = parsed * 24 * 60 * 60 * 1000;
+  if (!Number.isFinite(parsed) || parsed < 0 || !Number.isSafeInteger(milliseconds))
+    throw new TypeError(`${flag} must be a non-negative number of days.`);
+  return milliseconds;
+};
+var mobileUpdateRetention = (args) => {
+  const retainedValue = valueAfter(args, "--retain");
+  const retainRecent = retainedValue === undefined ? undefined : Number(retainedValue);
+  if (retainRecent !== undefined && (!Number.isSafeInteger(retainRecent) || retainRecent < 0))
+    throw new TypeError("--retain must be a non-negative integer.");
+  return {
+    minAgeMs: mobileUpdateDays(args, "--min-age-days"),
+    retainRecent
+  };
+};
+var printMobileUpdateStorage = (report) => {
+  console.log(`${report.appId}: ${report.releaseCount} releases use ${formatBytes(report.releaseBytes)}; ${formatBytes(report.reclaimableBytes)} is eligible across ${report.totalObjectCount} stored objects.`);
+  if (typeof report.contentBlobCount === "number" && typeof report.contentBlobBytes === "number" && typeof report.reclaimableContentBytes === "number" && report.contentBlobCount > 0)
+    console.log(`  Shared content: ${report.contentBlobCount} blobs use ${formatBytes(report.contentBlobBytes)}; ${formatBytes(report.reclaimableContentBytes)} becomes reclaimable with the eligible releases.`);
+  for (const release of report.releases) {
+    let state = "eligible";
+    if (release.protectedBy.length > 0)
+      state = `kept: ${release.protectedBy.join(", ")}`;
+    else if (release.markedAt)
+      state = `marked ${release.markedAt}`;
+    console.log(`  ${release.releaseId} ${release.channel} ${formatBytes(release.bytes)} (${state})`);
+  }
+  if (report.untrackedBytes > 0)
+    console.log(`${formatBytes(report.untrackedBytes)} is used by channels, collection markers, or incomplete/unrecognized objects and will not be swept as a release.`);
+};
+var inspectMobileUpdateStorage = async (args) => {
+  const startedAt = performance.now();
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update storage requires mobile.updates config.");
+  const policy = mobileUpdateRetention(args);
+  const { publisher } = await mobileUpdatePublisher(args);
+  const report = await inspectAbsoluteMobileUpdateStorage({
+    appId: mobile.appId,
+    publisher,
+    ...policy.minAgeMs === undefined ? {} : { minAgeMs: policy.minAgeMs },
+    ...policy.retainRecent === undefined ? {} : { retainRecent: policy.retainRecent }
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(report, null, 2));
+  else
+    printMobileUpdateStorage(report);
+  sendTelemetryEvent("mobile:update-storage", {
+    durationMs: Math.round(performance.now() - startedAt),
+    reclaimableReleaseCount: report.releases.filter((release) => release.protectedBy.length === 0).length,
+    releaseCount: report.releaseCount
+  });
+  return report;
+};
+var collectMobileUpdates = async (args) => {
+  const startedAt = performance.now();
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update gc requires mobile.updates config.");
+  const policy = mobileUpdateRetention(args);
+  const gracePeriodMs = mobileUpdateDays(args, "--grace-days");
+  const { publisher } = await mobileUpdatePublisher(args);
+  const result = await pruneAbsoluteMobileUpdates({
+    appId: mobile.appId,
+    apply: args.includes("--apply"),
+    publisher,
+    ...gracePeriodMs === undefined ? {} : { gracePeriodMs },
+    ...policy.minAgeMs === undefined ? {} : { minAgeMs: policy.minAgeMs },
+    ...policy.retainRecent === undefined ? {} : { retainRecent: policy.retainRecent }
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(result, null, 2));
+  else {
+    printMobileUpdateStorage(result);
+    if (result.dryRun)
+      console.log("No storage was changed. Re-run with --apply to mark eligible releases and sweep releases whose grace period has elapsed.");
+    else
+      console.log(`Collection applied: ${result.marked.length} marked, ${result.restored.length} restored, ${result.swept.length} swept, ${formatBytes(result.reclaimedBytes)} reclaimed.`);
+  }
+  sendTelemetryEvent("mobile:update-gc", {
+    applied: !result.dryRun,
+    durationMs: Math.round(performance.now() - startedAt),
+    markedCount: result.marked.length,
+    restoredCount: result.restored.length,
+    sweptCount: result.swept.length
+  });
+  return result;
+};
 var requireValueAfter = (args, flag) => {
   const value = valueAfter(args, flag);
   if (!value || value.startsWith("-")) {
@@ -24165,6 +24312,14 @@ var runMobile = async (args) => {
     await rollbackMobileUpdate(args.slice(2));
     return;
   }
+  if (command === "update" && args[1] === "storage") {
+    await inspectMobileUpdateStorage(args.slice(2));
+    return;
+  }
+  if (command === "update" && args[1] === "gc") {
+    await collectMobileUpdates(args.slice(2));
+    return;
+  }
   if (command === "publish" && args[1] === "android") {
     await publishAndroid(args.slice(2));
     return;
@@ -24173,7 +24328,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 export {
   runMobile

package/dist/index.js

@@ -12288,7 +12288,7 @@ import {
 } from "crypto";
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import path from "path";
-var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
   if (typeof value !== "string" || value.length === 0)
     throw new MobileUpdateRegistryError(`Mobile update ${field} is invalid`);
   return value;
@@ -12455,6 +12455,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file2) => `${releaseRoot(manifest)}/files/${file2.path}`;
+  const contentBlobKey = (appId, sha256) => `${root(appId)}/blobs/${sha256}`;
+  const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -12483,6 +12485,12 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const assertNotMarked = async (appId, releaseId) => {
+    if (!APP_ID.test(appId) || !RELEASE.test(releaseId))
+      throw new MobileUpdateRegistryError("Mobile update release identity is invalid");
+    if (await options.store.head(tombstoneKey(appId, releaseId)))
+      throw new MobileUpdateRegistryError("Mobile update release is marked for collection. Increase retention and apply garbage collection to restore it before promotion");
+  };
   const writeChannel = async (input, signal) => {
     const value = {
       ...input,
@@ -12507,6 +12515,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     input.signal?.throwIfAborted();
     if (input.rollout <= 0 || input.rollout > 1)
       throw new MobileUpdateRegistryError("Mobile update rollout is invalid");
+    await assertNotMarked(input.appId, input.releaseId);
     const release = await readManifest(input.appId, input.releaseId);
     if (!release || release.manifest.channel !== input.channel)
       throw new MobileUpdateRegistryError("Mobile update was not published to this channel");
@@ -12552,19 +12561,271 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       status: "selected"
     };
   };
+  const retentionValues = (input) => {
+    if (!APP_ID.test(input.appId))
+      throw new MobileUpdateRegistryError("Mobile update appId is invalid");
+    const retainRecent = input.retainRecent ?? DEFAULT_RETAIN_RECENT;
+    const minAgeMs = input.minAgeMs ?? DEFAULT_MIN_AGE_MS;
+    if (!Number.isSafeInteger(retainRecent) || retainRecent < 0)
+      throw new MobileUpdateRegistryError("Mobile update retained release count is invalid");
+    if (!Number.isSafeInteger(minAgeMs) || minAgeMs < 0)
+      throw new MobileUpdateRegistryError("Mobile update minimum release age is invalid");
+    return { minAgeMs, retainRecent };
+  };
+  const listObjects = async (appId, signal) => {
+    const list = options.store.list;
+    if (!list)
+      throw new MobileUpdateRegistryError("Mobile update storage does not support lifecycle listing");
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      signal?.throwIfAborted();
+      const page = await list({
+        ...cursor ? { cursor } : {},
+        prefix: `${root(appId)}/`
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update storage returned an invalid lifecycle cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    return objects;
+  };
+  const inventory = async (input) => {
+    const { minAgeMs, retainRecent } = retentionValues(input);
+    const objects = await listObjects(input.appId, input.signal);
+    const appRoot = `${root(input.appId)}/`;
+    const releasePrefix = `${appRoot}releases/`;
+    const channelPrefix = `${appRoot}channels/`;
+    const markerPrefix = `${appRoot}gc/`;
+    const blobPrefix = `${appRoot}blobs/`;
+    const objectKeysByRelease = new Map;
+    const objectBytesByRelease = new Map;
+    const objectKeysByDigest = new Map;
+    const objectBytesByDigest = new Map;
+    for (const blobObject of objects) {
+      if (blobObject.key.startsWith(blobPrefix)) {
+        const sha256 = blobObject.key.slice(blobPrefix.length);
+        if (HASH.test(sha256)) {
+          objectKeysByDigest.set(sha256, blobObject.key);
+          objectBytesByDigest.set(sha256, blobObject.size);
+        }
+      }
+      if (!blobObject.key.startsWith(releasePrefix))
+        continue;
+      const suffix = blobObject.key.slice(releasePrefix.length);
+      const releaseId = suffix.slice(0, suffix.indexOf("/"));
+      if (!RELEASE.test(releaseId))
+        continue;
+      objectKeysByRelease.set(releaseId, [
+        ...objectKeysByRelease.get(releaseId) ?? [],
+        blobObject.key
+      ]);
+      objectBytesByRelease.set(releaseId, (objectBytesByRelease.get(releaseId) ?? 0) + blobObject.size);
+    }
+    const channels = [];
+    for (const blobObject of objects) {
+      if (!blobObject.key.startsWith(channelPrefix) || !blobObject.key.endsWith(".json"))
+        continue;
+      const bytes = await options.store.get(blobObject.key);
+      if (!bytes)
+        throw new MobileUpdateRegistryError("Mobile update channel disappeared during lifecycle inspection");
+      const channel = parseChannel(decode(bytes));
+      if (channel.appId !== input.appId)
+        throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
+      channels.push(channel);
+    }
+    const markedAt = new Map;
+    for (const blobObject of objects) {
+      if (!blobObject.key.startsWith(markerPrefix) || !blobObject.key.endsWith(".json"))
+        continue;
+      const releaseId = blobObject.key.slice(markerPrefix.length, -".json".length);
+      if (!RELEASE.test(releaseId))
+        continue;
+      const bytes = await options.store.get(blobObject.key);
+      if (!bytes)
+        continue;
+      const marker = decode(bytes);
+      if (!object3(marker) || marker.format !== 1 || marker.appId !== input.appId || marker.releaseId !== releaseId || !iso(marker.markedAt))
+        throw new MobileUpdateRegistryError("Mobile update collection marker is invalid");
+      markedAt.set(releaseId, marker.markedAt);
+    }
+    const active = new Set(channels.flatMap((channel) => channel.releaseId ? [channel.releaseId] : []));
+    const fallback = new Set(channels.flatMap((channel) => channel.fallbackReleaseId ? [channel.fallbackReleaseId] : []));
+    const manifests = [];
+    for (const releaseId of objectKeysByRelease.keys()) {
+      const release = await readManifest(input.appId, releaseId);
+      if (release)
+        manifests.push(release.manifest);
+    }
+    const recent = new Set;
+    const manifestsByChannel = new Map;
+    for (const manifest of manifests)
+      manifestsByChannel.set(manifest.channel, [
+        ...manifestsByChannel.get(manifest.channel) ?? [],
+        manifest
+      ]);
+    for (const releases2 of manifestsByChannel.values())
+      for (const manifest of releases2.toSorted((left, right) => right.createdAt.localeCompare(left.createdAt)).slice(0, retainRecent))
+        recent.add(manifest.releaseId);
+    const now = clock().getTime();
+    const releases = manifests.map((manifest) => {
+      const protectedBy = [];
+      if (active.has(manifest.releaseId))
+        protectedBy.push("active");
+      if (fallback.has(manifest.releaseId))
+        protectedBy.push("fallback");
+      if (recent.has(manifest.releaseId))
+        protectedBy.push("recent");
+      if (now - Date.parse(manifest.createdAt) < minAgeMs)
+        protectedBy.push("age");
+      return {
+        bytes: objectBytesByRelease.get(manifest.releaseId) ?? 0,
+        channel: manifest.channel,
+        createdAt: manifest.createdAt,
+        ...markedAt.has(manifest.releaseId) ? { markedAt: markedAt.get(manifest.releaseId) } : {},
+        objectCount: objectKeysByRelease.get(manifest.releaseId)?.length ?? 0,
+        protectedBy,
+        releaseId: manifest.releaseId
+      };
+    }).toSorted((left, right) => right.createdAt.localeCompare(left.createdAt));
+    const protectedReleaseIds = new Set(releases.filter((release) => release.protectedBy.length > 0).map((release) => release.releaseId));
+    const protectedDigests = new Set(manifests.filter((manifest) => protectedReleaseIds.has(manifest.releaseId)).flatMap((manifest) => manifest.files.map((file2) => file2.sha256)));
+    const reclaimableContentBytes = [...objectBytesByDigest].filter(([sha256]) => !protectedDigests.has(sha256)).reduce((total, [, bytes]) => total + bytes, 0);
+    const contentBlobBytes = [...objectBytesByDigest.values()].reduce((total, bytes) => total + bytes, 0);
+    const releaseBytes = releases.reduce((total, release) => total + release.bytes, 0);
+    const totalBytes = objects.reduce((total, object22) => total + object22.size, 0);
+    return {
+      objectKeysByRelease,
+      objectKeysByDigest,
+      report: {
+        appId: input.appId,
+        channelCount: channels.length,
+        contentBlobBytes,
+        contentBlobCount: objectKeysByDigest.size,
+        reclaimableBytes: releases.filter((release) => release.protectedBy.length === 0).reduce((total, release) => total + release.bytes, 0) + reclaimableContentBytes,
+        reclaimableContentBytes,
+        releaseBytes,
+        releaseCount: releases.length,
+        releases,
+        totalBytes,
+        totalObjectCount: objects.length,
+        untrackedBytes: totalBytes - releaseBytes - contentBlobBytes
+      }
+    };
+  };
+  const pruneUpdates = async (input) => {
+    const initial = await inventory(input);
+    const result = {
+      ...initial.report,
+      dryRun: input.apply !== true,
+      marked: [],
+      reclaimedBytes: 0,
+      restored: [],
+      swept: [],
+      sweptContentBlobs: []
+    };
+    if (input.apply !== true)
+      return result;
+    const remove = options.store.delete;
+    if (!remove)
+      throw new MobileUpdateRegistryError("Mobile update storage does not support lifecycle deletion");
+    const gracePeriodMs = input.gracePeriodMs ?? DEFAULT_GRACE_PERIOD_MS;
+    if (!Number.isSafeInteger(gracePeriodMs) || gracePeriodMs < 0)
+      throw new MobileUpdateRegistryError("Mobile update collection grace period is invalid");
+    const now = clock();
+    for (const release of initial.report.releases) {
+      input.signal?.throwIfAborted();
+      const marker = tombstoneKey(input.appId, release.releaseId);
+      if (release.protectedBy.length > 0) {
+        if (release.markedAt) {
+          await remove(marker);
+          result.restored.push(release.releaseId);
+        }
+        continue;
+      }
+      if (!release.markedAt) {
+        const bytes = json({
+          appId: input.appId,
+          format: 1,
+          markedAt: now.toISOString(),
+          releaseId: release.releaseId
+        });
+        await options.store.put(marker, bytes, {
+          cacheControl: "no-cache",
+          contentType: "application/json",
+          maxBytes: bytes.byteLength,
+          metadata: { releaseid: release.releaseId, sha256: digest(bytes) },
+          signal: input.signal
+        });
+        result.marked.push(release.releaseId);
+      }
+    }
+    const current = await inventory(input);
+    for (const release of current.report.releases) {
+      input.signal?.throwIfAborted();
+      if (release.protectedBy.length > 0 || !release.markedAt || now.getTime() - Date.parse(release.markedAt) < gracePeriodMs || result.marked.includes(release.releaseId))
+        continue;
+      const checked = await inventory(input);
+      const candidate = checked.report.releases.find((value) => value.releaseId === release.releaseId);
+      if (!candidate || candidate.protectedBy.length > 0 || !candidate.markedAt)
+        continue;
+      const keys = checked.objectKeysByRelease.get(release.releaseId) ?? [];
+      for (const key of keys.toSorted((left, right) => {
+        const leftManifest = left.endsWith("/update.json");
+        const rightManifest = right.endsWith("/update.json");
+        return Number(leftManifest) - Number(rightManifest);
+      }))
+        await remove(key);
+      await remove(tombstoneKey(input.appId, release.releaseId));
+      result.reclaimedBytes += candidate.bytes;
+      result.swept.push(release.releaseId);
+    }
+    const afterReleaseSweep = await inventory(input);
+    const referencedDigests = new Set;
+    for (const release of afterReleaseSweep.report.releases) {
+      const manifest = await readManifest(input.appId, release.releaseId);
+      for (const file2 of manifest?.manifest.files ?? [])
+        referencedDigests.add(file2.sha256);
+    }
+    for (const [sha256, key] of afterReleaseSweep.objectKeysByDigest) {
+      if (referencedDigests.has(sha256))
+        continue;
+      const head = await options.store.head(key);
+      await remove(key);
+      result.reclaimedBytes += head?.size ?? 0;
+      result.sweptContentBlobs.push(sha256);
+    }
+    return result;
+  };
   return {
+    inspectUpdateStorage: async (input) => (await inventory(input)).report,
+    pruneUpdates,
     publishUpdate: async (input) => {
       input.signal?.throwIfAborted();
       const manifest = parseMobileUpdateManifest(input.manifest);
       verifyManifestSignature(manifest, options.publicKeys);
+      await assertNotMarked(manifest.appId, manifest.releaseId);
       const localRoot = path.resolve(input.releaseDirectory);
       const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile4(path.join(localRoot, "update.json"), "utf8")));
       if (JSON.stringify(localManifest) !== JSON.stringify(manifest))
         throw new MobileUpdateRegistryError("Local mobile update manifest changed");
       const existing = await readManifest(manifest.appId, manifest.releaseId);
       let reused = existing !== null;
+      let storedBytes = 0;
+      let storedFiles = 0;
+      let reusedBytes = 0;
+      let reusedFiles = 0;
       if (existing && JSON.stringify(existing.manifest) !== JSON.stringify(manifest))
         throw new MobileUpdateRegistryError("Published mobile update is immutable");
+      if (existing) {
+        reusedBytes = manifest.files.reduce((total, file2) => total + file2.bytes, 0);
+        reusedFiles = manifest.files.length;
+      }
       if (!existing) {
         for (const file2 of manifest.files) {
           const local = path.join(localRoot, "files", file2.path);
@@ -12573,18 +12834,24 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
             throw new MobileUpdateRegistryError(`Mobile update file ${file2.path} size changed`);
           if (await fileDigest(Bun.file(local)) !== file2.sha256)
             throw new MobileUpdateRegistryError(`Mobile update file ${file2.path} integrity failed`);
-          const key = fileKey(manifest, file2);
+          const key = contentBlobKey(manifest.appId, file2.sha256);
           const stored = await options.store.head(key);
           if (!stored) {
             await options.store.put(key, Bun.file(local).stream(), {
               cacheControl: "public, max-age=31536000, immutable",
               contentType: "application/octet-stream",
               maxBytes: file2.bytes,
-              metadata: { releaseid: manifest.releaseId, sha256: file2.sha256 },
+              metadata: { sha256: file2.sha256 },
               signal: input.signal
             });
-          } else if (stored.size !== file2.bytes || stored.metadata?.sha256 !== file2.sha256 || (stored.metadata?.releaseid ?? stored.metadata?.releaseId) !== manifest.releaseId)
-            throw new MobileUpdateRegistryError("Stored mobile update file identity changed");
+            storedBytes += file2.bytes;
+            storedFiles += 1;
+          } else if (stored.size !== file2.bytes || stored.metadata?.sha256 !== file2.sha256)
+            throw new MobileUpdateRegistryError("Stored mobile update content identity changed");
+          else {
+            reusedBytes += file2.bytes;
+            reusedFiles += 1;
+          }
         }
         const bytes = json(manifest);
         await options.store.put(manifestKey(manifest), bytes, {
@@ -12608,8 +12875,12 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       return {
         appId: manifest.appId,
         channel: manifest.channel,
+        storedBytes,
+        storedFiles,
         releaseId: manifest.releaseId,
         reused,
+        reusedBytes,
+        reusedFiles,
         rollout: input.rollout,
         stage: "published"
       };
@@ -12621,6 +12892,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       if (!existing)
         throw new MobileUpdateRegistryError("Mobile update channel does not exist");
       if (input.releaseId) {
+        await assertNotMarked(input.appId, input.releaseId);
         const release = await readManifest(input.appId, input.releaseId);
         if (!release || release.manifest.channel !== input.channel)
           throw new MobileUpdateRegistryError("Mobile rollback release was not published");
@@ -12657,14 +12929,16 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       const file2 = release.manifest.files.find((candidate) => candidate.path === requested);
       if (!file2)
         return null;
-      const key = fileKey(release.manifest, file2);
+      const legacyKey = fileKey(release.manifest, file2);
+      const legacyHead = await options.store.head(legacyKey);
+      const key = legacyHead ? legacyKey : contentBlobKey(release.manifest.appId, file2.sha256);
       const [bytes, head] = await Promise.all([
         options.store.get(key),
-        options.store.head(key)
+        legacyHead ? Promise.resolve(legacyHead) : options.store.head(key)
       ]);
       if (!bytes || !head)
         return null;
-      if (bytes.byteLength !== file2.bytes || head.size !== file2.bytes || head.metadata?.sha256 !== file2.sha256 || (head.metadata?.releaseid ?? head.metadata?.releaseId) !== release.manifest.releaseId || digest(bytes) !== file2.sha256)
+      if (bytes.byteLength !== file2.bytes || head.size !== file2.bytes || head.metadata?.sha256 !== file2.sha256 || legacyHead && (head.metadata?.releaseid ?? head.metadata?.releaseId) !== release.manifest.releaseId || digest(bytes) !== file2.sha256)
         throw new MobileUpdateRegistryError("Stored mobile update file integrity failed");
       return { bytes, file: file2 };
     }
@@ -12953,6 +13227,9 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
 var init_mobileUpdate = __esm(() => {
   MAX_FILE_BYTES = 32 * 1024 * 1024;
   MAX_TOTAL_BYTES = 128 * 1024 * 1024;
+  DAY_MS = 24 * 60 * 60 * 1000;
+  DEFAULT_MIN_AGE_MS = 30 * DAY_MS;
+  DEFAULT_GRACE_PERIOD_MS = 7 * DAY_MS;
   HASH = /^[a-f0-9]{64}$/;
   RELEASE = /^amu_[a-f0-9]{64}$/;
   APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
@@ -44587,5 +44864,5 @@ export {
   wrapPageHandlerWithStreamingSlots
 };
 
-//# debugId=D254EAF4F11DFBA864756E2164756E21
+//# debugId=CE82990F0B81B09764756E2164756E21
 //# sourceMappingURL=index.js.map